<html>
<head><meta charset="utf-8"><title>Avoid UB on Vec on shared memory without synchronization · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html">Avoid UB on Vec on shared memory without synchronization</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="180218253"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218253" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218253">(Nov 08 2019 at 10:34)</a>:</h4>
<p><span class="user-mention" data-user-id="128323">@Alan Jeffrey</span> what you are asking for cannot work</p>



<a name="180218262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218262">(Nov 08 2019 at 10:34)</a>:</h4>
<p>What you are trying to do is </p>
<div class="codehilite"><pre><span></span><span class="k">struct</span> <span class="nc">SharedVec</span><span class="p">(</span><span class="n">UnsafeCell</span><span class="o">&lt;</span><span class="nb">Vec</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;&gt;</span><span class="p">);</span><span class="w"></span>
<span class="k">unsafe</span><span class="w"> </span><span class="k">impl</span><span class="w"> </span><span class="nb">Sync</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">SharedVec</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="k">static</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">SHARED</span>: <span class="nc">SharedVec</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">SharedVec</span><span class="p">(...);</span><span class="w"></span>
</pre></div>



<a name="180218353"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218353" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218353">(Nov 08 2019 at 10:36)</a>:</h4>
<p>and then have two threads of execution, writing and reading to the vector without any synchronization</p>



<a name="180218361"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218361" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218361">(Nov 08 2019 at 10:36)</a>:</h4>
<p>You are using <code>read_volatile</code> and <code>write_volatile</code> for that, and that's UB.</p>



<a name="180218367"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218367" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218367">(Nov 08 2019 at 10:36)</a>:</h4>
<p>You are just hoping that the compiler is dumb enough not to properly optimize your programs.</p>



<a name="180218391"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218391" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218391">(Nov 08 2019 at 10:37)</a>:</h4>
<p>You'd need something like <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/212" target="_blank" title="https://github.com/rust-lang/unsafe-code-guidelines/issues/212">ucg#212</a> to avoid that kind of UB by using <code>atomic volatile</code> reads / writes on the memory.</p>



<a name="180218406"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218406" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218406">(Nov 08 2019 at 10:37)</a>:</h4>
<p>But that only removes the UB of the data-races to the individual accesses.</p>



<a name="180218469"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218469" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218469">(Nov 08 2019 at 10:38)</a>:</h4>
<p>If one process calls <code>Vec::resize</code> or <code>Vec::set_len</code>, the <code>(ptr, cap, len)</code> state of the vector will be altered without any synchronization, invalidating the <code>(ptr, cap, len)</code> of the other process.</p>



<a name="180218491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218491">(Nov 08 2019 at 10:38)</a>:</h4>
<p>That's a data-race, and the only way to avoid it is via synchronization, e.g., by using a "concurrent vec" instead, or by putting the <code>Vec</code> behind a mutex or similar</p>



<a name="180218524"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218524" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218524">(Nov 08 2019 at 10:39)</a>:</h4>
<p>Different OSes have different primitives for IPC, permissions, etc. - so you could build a safe abstraction by using those (e.g. see what Boost.Interprocess does - its documentation explains this particular case)</p>



<a name="180218598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218598">(Nov 08 2019 at 10:40)</a>:</h4>
<p>Without synchronization, you are seeing that a process can call <code>Vec::resize</code> to truncate the vector, invalidating the <code>len</code> field that a different process has, and then that process does a use-after-free because of the invalid <code>len</code>, and you get a <code>SIGBUS</code>.</p>



<a name="180218631"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218631" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218631">(Nov 08 2019 at 10:41)</a>:</h4>
<p>None of that matters, because the moment the <code>len</code> field was invalidated without synchronization, both processes already have UB, that is, Rust does not provide any guarantees about what any of those processes do, independently of the languages they are written in.</p>



<a name="180218647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218647">(Nov 08 2019 at 10:41)</a>:</h4>
<p>So you can get a <code>SIGBUS</code>, or the rust process can crash, or format your hard drive, or ... anything is allowed at that point.</p>



<a name="180218707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218707">(Nov 08 2019 at 10:42)</a>:</h4>
<p>It also doesn't matter whether the two threads of execution are in the same or different processes, if its UB within the same process, _it is UB if you spawn the threads in different processes_, and it doesn't matter if you implement the other thread in a different programming language.</p>



<a name="180218728"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218728" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218728">(Nov 08 2019 at 10:43)</a>:</h4>
<p>I also can't think of any language tools that anybody can give you to make these particular data-races not be UB.</p>



<a name="180218783"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218783" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218783">(Nov 08 2019 at 10:44)</a>:</h4>
<p>Either never write to the <code>(ptr, len, cap)</code> field, so that all processes just read them, or you need to use synchronization.</p>



<a name="180218805"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218805" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218805">(Nov 08 2019 at 10:44)</a>:</h4>
<p>Depending on your OS, there might be ways you can require other adversarial processes to also use those synchronization primitives.</p>



<a name="180218822"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218822" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218822">(Nov 08 2019 at 10:45)</a>:</h4>
<p>But if you cannot do that on a particular platform, then you can't really write a safe abstraction around that, because it isn't safe to do so.</p>



<a name="180218834"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180218834" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180218834">(Nov 08 2019 at 10:45)</a>:</h4>
<p>Ask your OS, but from the OS POV, a valid answer might be "don't share shared memory with processes you don't trust", which is kind of fair as well. Best case you get an answer like "when creating the shared memory, pass flag X to forbid truncating it".</p>



<a name="180219012"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180219012" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180219012">(Nov 08 2019 at 10:48)</a>:</h4>
<p><a href="https://www.boost.org/doc/libs/1_71_0/doc/html/interprocess/synchronization_mechanisms.html" target="_blank" title="https://www.boost.org/doc/libs/1_71_0/doc/html/interprocess/synchronization_mechanisms.html">https://www.boost.org/doc/libs/1_71_0/doc/html/interprocess/synchronization_mechanisms.html</a></p>



<a name="180219129"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180219129" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180219129">(Nov 08 2019 at 10:50)</a>:</h4>
<p>What you probably want is something like this (IPC mutexes require all processes to "play nice"): <a href="https://www.boost.org/doc/libs/1_71_0/doc/html/interprocess/synchronization_mechanisms.html#interprocess.synchronization_mechanisms.file_lock" target="_blank" title="https://www.boost.org/doc/libs/1_71_0/doc/html/interprocess/synchronization_mechanisms.html#interprocess.synchronization_mechanisms.file_lock">https://www.boost.org/doc/libs/1_71_0/doc/html/interprocess/synchronization_mechanisms.html#interprocess.synchronization_mechanisms.file_lock</a></p>



<a name="180219153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180219153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180219153">(Nov 08 2019 at 10:51)</a>:</h4>
<p>and use mandatory locking if you want a safe abstraction.... but mandatory locking is kind of broken on most OSes.</p>



<a name="180272296"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180272296" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180272296">(Nov 08 2019 at 21:09)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span>  Yes, you can't just put a <code>Vec</code> in shared memory and hope that it'll be OK,</p>



<a name="180272386"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180272386" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180272386">(Nov 08 2019 at 21:10)</a>:</h4>
<p>hence <a href="https://github.com/asajeffrey/shared-data/blob/master/src/shared_vec.rs" target="_blank" title="https://github.com/asajeffrey/shared-data/blob/master/src/shared_vec.rs">https://github.com/asajeffrey/shared-data/blob/master/src/shared_vec.rs</a></p>



<a name="180272431"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180272431" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180272431">(Nov 08 2019 at 21:10)</a>:</h4>
<p>which uses an <code>AtomicUsize</code> for the length.</p>



<a name="180272485"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180272485" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180272485">(Nov 08 2019 at 21:11)</a>:</h4>
<p>This doesn't quite do everything, since it's using atomic loads and stores rather than atomic volatiles.</p>



<a name="180272622"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180272622" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180272622">(Nov 08 2019 at 21:12)</a>:</h4>
<p>and it's not supporting growing yet.</p>



<a name="180272739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180272739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180272739">(Nov 08 2019 at 21:14)</a>:</h4>
<p>and truncation of the underlying shared memory file is still an issue, different OSs seem to have different ways round that, sigh.</p>



<a name="180365824"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180365824" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180365824">(Nov 10 2019 at 14:40)</a>:</h4>
<p><span class="user-mention" data-user-id="128323">@Alan Jeffrey</span> I don't understand which problem does that <code>AtomicUsize</code> solve</p>



<a name="180365845"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180365845" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180365845">(Nov 10 2019 at 14:41)</a>:</h4>
<p>The shared memory that you are using (a file descriptor, with a length and a memory block), has a "length" that can be modified concurrently (depending on the OS, and certain options)</p>



<a name="180365846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180365846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180365846">(Nov 10 2019 at 14:41)</a>:</h4>
<p>That's the length that must be synchronized</p>



<a name="180365904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180365904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180365904">(Nov 10 2019 at 14:42)</a>:</h4>
<p>That data-structure is like a vector, but the <code>SharedVec</code> that you are creating there is like a <code>&amp;[T]</code>.</p>



<a name="180365916"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180365916" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180365916">(Nov 10 2019 at 14:42)</a>:</h4>
<p>Making the length field of a <code>&amp;[T]</code> atomic does not solve the problem of multiple threads of execution modifying the <code>Vec</code> that actually owns that memory</p>



<a name="180386358"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180386358" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180386358">(Nov 10 2019 at 23:38)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> Assuming no truncation, the length is never set to more than the <code>SharedVec</code> allocation, and the requirement that <code>T</code> implements <code>SharedMemCast</code>/<code>Ref</code> means that every bitstring is a valid inhabitant of <code>T</code>.</p>



<a name="180386375"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180386375" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180386375">(Nov 10 2019 at 23:39)</a>:</h4>
<p>So since the Len is atomic, there's no data races, and AFAICT there's no other sources of UB.</p>



<a name="180600441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180600441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180600441">(Nov 13 2019 at 07:54)</a>:</h4>
<p>If the "assuming no truncation" assumption is violated, then you have UB. If the file grows enough, such that no consecutive virtual memory pages can be allocated in your process for the file, you might have a problem as well (Does the OS reallocate the virtual memory pages to a new range that fits for you or invalidates the previous range? That would concurrently invalidate the "ptr" field).</p>



<a name="180600470"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180600470" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180600470">(Nov 13 2019 at 07:55)</a>:</h4>
<blockquote>
<p>So since the Len is atomic, there's no data races,</p>
</blockquote>
<p>The len of <code>Vec</code> or <code>&amp;[T]</code> is not atomic, so I don't understand which problem having an atomic length solves for <code>SharedVec</code>.  If you assume that the file will not be resized, its length can just be an <code>usize</code>.</p>



<a name="180600614"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid%20UB%20on%20Vec%20on%20shared%20memory%20without%20synchronization/near/180600614" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Avoid.20UB.20on.20Vec.20on.20shared.20memory.20without.20synchronization.html#180600614">(Nov 13 2019 at 07:57)</a>:</h4>
<p>The only reason I can think of to make the length of <code>SharedVec</code> atomic would be if you want to allow concurrent modifications of it from a single process, but since <code>SharedVec</code> is like a <code>&amp;[T]</code>, that is like making a <code>&amp;[T]</code> atomic to try to allow modifying it concurrently. Can be done, but isn't necessary, and often it isn't desirable. It's ok for each thread to have a different copy of the <code>&amp;[T]</code>, and it's ok if these have different lengths. You can also create them in one thread and <code>Send</code> them to another thread just fine.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>